What is the CVSS score of CVE-2026-6235?

CVE-2026-6235 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Sendmachine for WordPress are affected by CVE-2026-6235?

Sendmachine for WordPress plugin versions 1.0.20 and earlier contain a critical authorization bypass allowing unauthenticated attackers to hijack email routing, redirecting password resets and…

How to fix or mitigate CVE-2026-6235?

Within 24 hours: audit all WordPress installations for Sendmachine plugin presence and document version numbers; immediately disable the plugin on all systems. Within 7 days: contact Sendmachine vendor for patch timeline and evaluate alternative SMTP plugins (e.g., WP Mail SMTP Pro, SendGrid for WordPress) for migration planning. Within 30 days: complete migration to patched or alternative solution and verify SMTP configuration integrity across all sites.

Sendmachine for WordPress CVE-2026-6235

EUVD-2026-24700 CRITICAL

Missing Authorization (CWE-862)

2026-04-22 Wordfence

GHSA-4x86-c4g3-px96

Authentication Bypass WordPress

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Apr 22, 2026 - 09:59 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24700

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

CRITICAL 9.8

DescriptionCVE.org

The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the 'manage_admin_requests' function in all versions up to, and including, 1.0.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the plugin's SMTP configuration, which can be leveraged to intercept all outbound emails from the site (including password reset emails).

AnalysisAI

Authorization bypass in Sendmachine for WordPress plugin (versions ≤1.0.20) allows unauthenticated remote attackers to overwrite SMTP configuration settings without authentication. Attackers can redirect all outbound emails from WordPress sites - including password reset tokens and sensitive communications - to attacker-controlled servers, enabling credential theft and account takeover. CVSS 9.8 (Critical) reflects network attack vector with no authentication or user interaction required. No active exploitation confirmed at time of analysis, though the straightforward attack path (single HTTP request to exposed admin function) makes this a high-priority remediation target for sites using this plugin.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization) in the 'manage_admin_requests' function within sendmachine_wp_admin.php. WordPress plugins typically enforce authorization checks using functions like current_user_can() or check_admin_referer() before processing administrative actions. The vulnerable code at lines 174-183 processes SMTP configuration updates without verifying the requesting user has administrative privileges or valid nonces. The affected sendmachine_email_manager.php component at line 39 handles email routing configuration. CPE identifier cpe:2.3:a:sendmachine:sendmachine_for_wordpress confirms this affects the Sendmachine for WordPress plugin across all versions through 1.0.20. SMTP hijacking attacks exploit this by submitting crafted POST requests directly to the plugin's admin handler, bypassing WordPress's standard authentication middleware entirely.

RemediationAI

Immediately update Sendmachine for WordPress plugin to version 1.0.21 or later if available (verify current version at official WordPress plugin repository). If no patched version exists, disable and deactivate the plugin until vendor releases a fix - access WordPress admin dashboard, navigate to Plugins, locate Sendmachine for WordPress, and click Deactivate then Delete. Compensating control if plugin functionality is business-critical: implement WordPress application firewall rules (via plugins like Wordfence or firewall-level WAF) to block unauthenticated POST requests to /wp-admin/admin-ajax.php with action parameters matching sendmachine admin functions, though this requires careful tuning to avoid blocking legitimate traffic and may break plugin functionality. Review WordPress email logs and SMTP configuration immediately for unauthorized changes - check for unfamiliar SMTP servers, authentication credentials, or port configurations. Monitor outbound email headers for unexpected relay servers. Audit user accounts for suspicious password resets or new administrator accounts created via intercepted reset emails. Consult vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/7889e071-84a8-46ec-abe5-5c98980ce275 for specific patch details and indicators of compromise.